# Tag Info

9

I'll assumme All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that. All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks): Eve intercepts message $M=M_0||M_1$ and its authenticator ...

9

A Message Authentication Code (MAC) is a string of bits that is sent alongside a message. The MAC depends on the message itself and a secret key. No one should be able to compute a MAC without knowing the key. This allows two people who share a secret key to send messages to each without fear that someone else will tamper with the messages. (At least, if ...

8

In general, a MAC with a known fixed "key" is not a secure hash. That is, you can have a secure MAC (that is, someone without the key, but with a large number of message/MAC pairs, cannot come up with another valid message/MAC pair) that is not collision resistant, or even preimage resistant, if the attacker does know the key. In addition, you don't have ...

8

The generic model for a MAC is the following: the attacker is given access to a block box which implements the $S$ function with a key $k$ that the attacker does not know of. The attacker is allowed to make $q$ requests to the box on messages that he can choose arbitrarily. The goal of the attacker is to make a forgery, i.e. produce values $m$ and $t$ such ...

6

How does the length extension attack against $H(k||m)$ work? For Merkle-Damgård hashes, if you know $H(x)$ but not $x$ you can still choose an $e$ and then compute $H(x||p||e)$. With $x=k||m$ you can compute $H((k||m||p)||e)=H(k||(m||p||e))$ which is a valid authentication tag for $m||p||e$. Why doesn't it work against $H(m||k)$? With a length extension ...

5

Just thinking out loud here: Take a picture of the contents of a box. Put these pictures in a safe. Ship box and safe together, lock with key of sender. Receiver unlocks safe, compares pictures with contents of box. The safe and keys are already common for symmetric encryption too.

5

If I understand you correctly, you want to use $C = \mathrm{Enc}_{K,N}(m || \mathrm{hash}(m))$ as authenticated encryption. This is a bad idea, even for cryptographically secure hashes. Consider an attacker who knows your plaintext $m$ and wants to replace it by $m^\prime$. He calculates $C^\prime = C \oplus (m || \mathrm{hash}(m)) \oplus (m^\prime || ... 5 Don't believe every claim ever made in any paper ever written, particularly when the paper provides little or no justification for the claim; not everything you read reflects the cryptographic consensus. This is particularly true for a paper written in 2002, which is a time our understanding of authenticated encryption and security engineering was still in ... 5 Digital signatures are used to solve this type of problem. That is, a way for$A$to sign the message for$B$so that$B$is highly confident that$A$signed the message in question. There are lots of signature schemes out there, such as RSA signing, DSA, and others. A MAC is not strictly a digital signature, but has a subset of that functionality and may ... 5 Yes, this looks fine. I assume$A$and$B_i$are trusted parties. The protocol as I understand it looks like this:$A$,$B_1$,…,$B_n$agree on a secret key k.$A$broadcasts messages ($m_1$,MAC($m_1$,$k$)), … , ($m_j$,MAC($m_j$,$k$) which$B_1$,…,$B_n$receive and authenticate. I assume$A$and$B_i$are trusted parties, so no$B_i$will itself ... 5 This depends on the MAC algorithm. Two examples: With HMAC based on a secure hash function, no, there is no known way to construct a message fitting the MAC other than brute-forcing it. (If you want to find a specific message, like when you have a MAC of a message containing a password and some fixed text, brute-forcing the password might be quite ... 5 Yes, your MAC is secure. It's probably not quite as secure as you're expecting it to be, and it's not a construction I would recommend to anyone, but it should be secure. Let's start with a simpler variant:$F_K(M) = E_K(H(M))$where$H(\cdot)$is a 128-bit collision-resistant hash (say, the first 128 bits of SHA1) and where$E_K(\cdot)$is a 128-bit ... 5 Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which. CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts ... 5 As K.G. and nightcracker note, the reason we don't recommend this method of password storage is that it becomes insecure if the secret$k$is compromised. Given that the whole point of password hashing is to protect the passwords in the event that your server is compromised, it's generally not safe to assume that the compromise won't include the secret key ... 4 To answer your original question: no, you can't presume that you can replace the addition mod$2^{128}$within$Poly1305$with XOR, and not change the security properties (at least, not without some serious analysis). The security of the MAC depends on the fact that, given any two distinct messages$M_1$and$M_2$, and any integer$\Delta$, then the ... 4 The birthday attack can be used with every hash function. It's a simple matter of probability (see: birthday problem). However, that only means that a hash function has to generate$2n$of output to achieve$n$bits of security. It's fairly obvious that$H(m||k)$is collision-resistant provided that$H$itself is collision-resistant, since ... 4 Yes, the scheme is weak, and made weaker by adding the SHA-512 hash of the password. The ciphertext being assumed known, this scheme allows testing if a user password is genuine with little effort: compute the SHA-256 hash of the password to be tested using that as the key, decipher at least the portion of the ciphertext corresponding to the SHA-512 hash ... 4 To answer your question: yes, GMAC does have niche applications where it performs better than either HMAC or CMAC; however it might not make sense for you. First of all, you are correct in that GMAC requires an IV, and bad things happen if a particular IV value is reused; this rather rules out GMAC for some applications, and is a cost even for applications ... 4 One of the factors that determines how hard it is to forge a MAC for a given message is how long the MAC is. If it's 1 bit long, you can definitely produce the correct MAC in two tries.$2^n$is the number of possible bit-strings of length$n$;$1/2^n$is the probability that any random bit-string happens to be the MAC (of length$n$) for a given message ... 4 Non-authenticated symmetric encryption schemes are generally malleable, meaning that an attacker who intercepts a message may be able to modify it even without knowing the key, e.g. by flipping arbitrary bits in it. A MAC prevents such attacks by detecting any modifications made to the ciphertext. Also, there are various chosen-ciphertext attacks that work ... 3 Does it negatively affect security to calculate a hash value of the ciphertext before MAC calculation? Like exchanging step 2. with this: HMAC-SHA256(SHA256(ciphertext)). Technically, yes, but not significantly. In order to attack the scheme you propose, the attacker would have to be able to do at least one of two things: (1) Find an attack on the ... 3 Yes, it is very possible. And quite efficient, too.$\DeclareMathOperator{\crc}{crc}$CRC is linear, meaning$\crc(x \oplus y) = \crc(x) \oplus \crc(y)$. This property is fantastic for an attacker. Let your 100-byte message be called$m$. Now suppose you wish to change the value of the byte$a$to$a'$. Compute$d = a \oplus a'$. Now, pad$d$with zeroed ... 3 Here is a decent analogue: a hidden watermark on paper, activated chemically perhaps. Maybe the watermark is a pattern of dots. Anyone with knowledge of the watermark and how to activate it could verify the authenticity of the document, whereas anyone without knowledge would not be able to. I assume bank notes in real life have similar watermarks, although ... 3 If the receiver can wait for all the packets before decrypting: This case is simple, since your final goal is to ensure that the plaintext you decrypt was the exact same plaintext you encrypted. (Trivially, this includes rejecting re-ordered plaintext.) Use an Authenticated Encryption (AE) scheme (eg, CCM, GCM, etc) across all the packets, treating the ... 3 The MAC algorithm you describe is called "the secret suffix method" in that paper. See the following paper, which shows how to attack the secret suffix method: On the security of two MAC algorithms. Bart Preneel, Paul C. van Oorschot. Eurocrypt'96, Springer LNCS vol.1070, pp.19-32, 1996. The paper describes how to use internal collisions to attack the ... 3 Accoding to UMAC RFC Section 6.1, you can use any other "cryptographic objects" instead of AES: The strength of UMAC depends on the strength of its underlying cryptographic functions: the key-derivation function (KDF) and the pad-derivation function (PDF). In this specification, both operations are implemented using a block cipher, by default the ... 3 A MAC is a shipping note or delivery note, which comes in a locked box. You need a key to open it, otherwise you can't see its content, and it has the be the same key as the one used by the sender. Inside, there is a description of something else, like "this delivery contains 173 kg bananas and 43 kg apples". If the box is undamaged and can be opened with ... 3 You can construct a one-time MAC that has a similar properties to the OTP. Better still, it uses a fixed number of bits for each message. Here's how it works. Choose the closet prime to your message block size. Let's say you plan to process 128-bit chunks of your message. Let's say there are$L$such blocks. The first job is to pick the first prime larger ... 3 Quite a difficult question. What you seem to need is a one-way permutation$P$. Indeed, suppose you have it of width$d$, then consider the function $$F(K,S,R_S) = E_{K_2}(P(E_{K_1}(S,R_S))),$$ where$E$is any good 64-bit block cipher (say, Simon) and$K_1,K_2$are derived from$K$. This function$F\$ should fulfill (2) because of the encryptions of both ...

2

A MAC is a general term describing message authentication code. That is a tag that will verify the integrity of your data. You will be able to say whether or not an attacker hash tampered with the data that you receive. One construction is HMAC and it uses a hash function as a basic building block. There is another way which is CBC-MAC and its improved ...

Only top voted, non community-wiki answers of a minimum length are eligible